chown :adm /var/log/audit/
sed -i '/^log_group/D' /etc/audit/auditd.conf
sed -i /^log_file/a'log_group = adm' /etc/audit/auditd.conf 
systemctl kill auditd -s SIGHUP